The Citizen Lab

Academic research unit at @UofT investigating novel threats to democracy, human rights, and global security in the digital ecosystem.

[The Citizen Lab @citizenlab]

Thread 🧵
1/ NEW REPORT: Billions of advertising auctions determine in real time which ads we see on websites and in apps every day. Our latest research shows how the same data fueling this advertising ecosystem is being used to profile millions of users and silently infect targets with zero-click mercenary spyware, a novel attack technique we call "Adfection.”

Read the report: https://t.co/EL39T3OoeC

[The Citizen Lab @citizenlab]

On Nov 20, join co-authors @emiledirks and @dianafutweets for a discussion about their upcoming book “How Global China Governs its Diaspora: Consent & Coercion.”

Register here: https://t.co/1ZQy53Zlo5

[Jon Penney @jon_penney]

Last week, I had the opportunity to appear before the Canadian House of Commons Subcommittee on International Human Rights to testify as to the global impact of AI on human rights.

My opening statement is here: https://t.co/BSFJl1or9g

Full hearing here: https://t.co/MF60VmSj3r

[The Citizen Lab @citizenlab]

🏆 A team of Citizen Lab and Princeton researchers have won the IRTF Applied Networking Research Prize for their work on the network security of Android apps.

Read more here: https://t.co/RMHGXCEp9P

[The Citizen Lab @citizenlab]

🗓️OCT 29: Join @rondeibert at Cyber Security Nordic in Helsinki at 12:30PM tomorrow. His keynote explores how the expanding surveillance economy is challenging democratic institutions and civil liberties.

Register here: https://t.co/UlugjzOC5u

[CyberScoop @CyberScoopNews]

That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it.

The Citizen Lab at the University of Toronto on Thursday said it was revealing the first details of zero-click spyware being delivered through targeted advertising, which it’s calling AdFection. It concluded that while the Israeli company Discover-Tech presents itself as a legitimate advertising firm, in actuality it operates as a facilitator for multiple mercenary spyware partners, including the well-known Candiru. Its ads covertly direct millions of devices to contact Candiru’s servers. https://t.co/tBZKkYcpdG

[The Citizen Lab @citizenlab]

In a timely discussion about Canada’s proposed Lawful Access Act @KateRobertson_ highlights the importance of repairing and preventing vulnerabilities “rather than drilling more holes in our every day communications systems.”

Listen to the full conversation hosted by @TCIS_Canada: https://t.co/ixb7CbXJSr

[The Citizen Lab @citizenlab]

3/ Pundyk, Anstis, and Michaelsen argue that the misuse of technology produced by AI companies can have an adverse impact on human rights without protocols for responding to AI-enabled digital transnational repression.

[The Citizen Lab @citizenlab]

1/ Citizen Lab researchers Kate Pundyk, Siena Anstis, and @mmichae1sen discuss the rise of AI-enabled digital transnational repression in their piece for @just_security.

https://t.co/cfJSkBIZdL

[The Citizen Lab @citizenlab]

2/ A recent report from Anthropic’s Threat Intelligence team gives direct evidence that generative AI is “being incorporated into the machinery of cross-border repression,” enabling authoritarian governments to identify, monitor, and target diaspora activists and exiled dissidents around the world.

[Hannah Neumann @HNeumannMEP]

Together with @saskiabricmont and 33 other MEPs from 5 political groups, we urge @Europarl_EN, @EU_Commission, and @EUCouncil to investigate their exposure to zero-click spyware.

More in our letter:

1/2

[The Citizen Lab @citizenlab]

Director @RonDeibert gave a keynote address at SecTor 2026, warning that spyware and surveillance have been “super-charged” thanks to AI. Read about his talk in @DarkReading.

https://t.co/oCRdIhv44b

[John Scott-Railton @jsrailton]

🚨NEW INVESTIGATION: University of Belgrade Rector who resisted crackdown on students was hacked with zero-click Pegasus.

Authorities raided his offices in March.

Serbia's snap elections are 6 days away.

There are more targets 1/

With @ShareConference https://t.co/cwFP5qyfNw

[The Citizen Lab @citizenlab]

4/Robertson argues that strong encryption is critical to cybersecurity, and that government efforts to create lawful-access mechanisms, surveillance capabilities, or backdoors in communication technologies makes all Canadians less safe.

[The Citizen Lab @citizenlab]

1/“The assumption by government officials that technology companies can find “safe ways” to weaken critical cybersecurity protections badly misreads the current threat landscape,” writes the Citizen Lab’s @KateRobertson_ in her new piece on Bill C-22 for @GlobeandMail.

https://t.co/gUOTroagAb

[The Citizen Lab @citizenlab]

3/The bill would force the stockpiling of all Canadians’ sensitive metadata, and everything from smartphones, smartwatches, banking apps, health apps, video game platforms, and public WiFi or CCTV networks could be accessed by law enforcement.

[The Citizen Lab @citizenlab]

4/Robertson argues that strong encryption is critical to cybersecurity, and that government efforts to create lawful-access mechanisms, surveillance capabilities, or backdoors in communication technologies makes all Canadians less safe.

[The Citizen Lab @citizenlab]

3/The bill would force the stockpiling of all Canadians’ sensitive metadata, and everything from smartphones, smartwatches, banking apps, health apps, video game platforms, and public WiFi or CCTV networks could be accessed by law enforcement.

[Al Jazeera PR @AlJazeera]

Al Jazeera Media Network condemns the spyware attacks targeting a number of its staff, as documented in a Citizen Lab report released today. Al Jazeera worked voluntarily with Citizen Lab's researchers, and, as the report notes, that cooperation helped verify and publicly document these attacks. The Network has taken, and continues to take, appropriate steps to protect its staff and systems.

The targeting of journalists is an attack on press freedom and on the public's right to know. Those responsible must be held accountable.

[The Citizen Lab @citizenlab]

5/This report presents the first public technical documentation of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements.

[The Citizen Lab @citizenlab]

Thread 🧵
1/ NEW REPORT: Billions of advertising auctions determine in real time which ads we see on websites and in apps every day. Our latest research shows how the same data fueling this advertising ecosystem is being used to profile millions of users and silently infect targets with zero-click mercenary spyware, a novel attack technique we call "Adfection.”

Read the report: https://t.co/EL39T3OoeC

[The Citizen Lab @citizenlab]

4/ Our research shows devices at international news network Al Jazeera were infected with mercenary spyware from Candiru (rebranded as “Integrity Labs”) via targeted online advertisements.